Blue Heron Digital Services, LLC · IT, cloud, and security

IT and Cloud Checkup

One estimate for the domain and the systems you actually use. A module you leave blank says add this to check. It is not scored as a zero. SOC 2 here is readiness only. A verified domain breach report comes later, and only after you confirm you control the domain.

What do you use?
Backup and ransomware readiness
Do you keep backups of email, files, and the systems that run the business?
Has a restore been tested in the last 6 months?
Is there a copy an attacker on the network cannot change?
Does the backup admin account use multifactor authentication?
Is there a written step for what to do if files are encrypted by ransomware?
Cyber insurance readiness
Is multifactor authentication on for email and admin accounts?
Do laptops and servers run endpoint detection, not only antivirus?
Are backups tested, and is one copy offline or immutable?
Do staff take security training at least once a year?
Are important patches applied within 30 days?
Is there a written incident response plan?
Microsoft 365 Security Hardening
Is multifactor authentication on for users and for admin accounts?
Do admins sign in through a conditional access rule, not only a password?
Is legacy authentication blocked?
Are admin roles limited to the people who need them?
Does someone look at Microsoft Secure Score on a regular schedule?
Is external sharing limited to what the business actually needs?
Is mailbox auditing turned on?
Are Defender or Purview protections in use for mail and files?
Is Microsoft 365 mail and file data backed up outside the tenant?
Incident response readiness
Is there a written incident response plan?
Are the people to call listed, including after hours?
Have restores been tested?
Do you know the cyber insurance carrier hotline?
Are sign-in and admin logs kept long enough to investigate?
Does each person know their role during an incident?
FTC Safeguards readiness
Is a Qualified Individual named for the information security program?
Is there a written risk assessment?
Is there a written information security plan (WISP)?
Is multifactor authentication on for systems that hold customer information?
Is customer information encrypted in transit and at rest?
Do you monitor and test the safeguards?
Do staff get security training?
Do you oversee vendors that touch customer information?
Is there a written incident response plan?
Do you give the owner or board a security update at least once a year?
If 500 or more customers were affected, could you notify the FTC within 30 days?
If you prepare taxes, do you confirm a security plan when you renew your PTIN?
AI use and Copilot readiness
Do you know which AI tools staff already use?
Are there written rules for what data may go into an AI tool?
Are sensitivity labels or permissions reviewed so the wrong files are not shared?
Do you know who would be licensed if you turned on Microsoft 365 Copilot?
Is there a written AI use policy?
Has someone checked for overshared files or sites?
IT leadership gap
Is one person named as the IT owner?
Is one person named for security decisions?
Is there a list of IT and security vendors?
Does someone review backups and admin accounts at least monthly?
Is there a budget for IT and security, not only break-fix?
Is there a contact for after-hours problems?

Windows 11 readiness

How many computers are in use?
How many of those are still on Windows 10, or cannot run Windows 11?
Hurricane continuity
Are backups kept offsite, or somewhere a storm at the office would not reach?
Do you know the date of the last tested restore?
Is there a contact tree for a storm or outage?
Is there a backup for power or internet if the office goes down?
Can people reach the files and apps they need from home?
CMMC Level 1 readiness
Is system access limited to authorized users, processes, and devices?
Is access limited to the transactions each person is allowed to do?
Do you control connections to external systems?
Is information on public systems controlled?
Can you identify users, processes, and devices?
Do you verify those identities before granting access?
Is media with federal contract information wiped or destroyed before disposal or reuse?
Is physical access to systems and equipment limited to authorized people?
Are visitors escorted, with physical access logged and access devices controlled?
Are communications monitored and protected at the network boundary?
Are public-facing components separated from the internal network?
Are system flaws identified, reported, and corrected in a timely way?
Is there protection from malicious code?
Are malicious-code protections updated when new releases are available?
Do you scan systems periodically and scan files from outside as they arrive?

Card payments and the office network

Optional. The card result is an estimate of which questionnaire likely applies. Serving nationwide.

How do you take cards?
Do you store card numbers after the sale?
How old is the main office router?
Is guest Wi-Fi separated from the office network?
Is router and access-point firmware updated?
Are there dead zones in the office Wi-Fi?
Is there a backup internet connection?

Security questionnaire

Optional. You do not need to upload the questionnaire.

What kind of questionnaire is it?
About how many questions are in it?
When is it due?

Intune and cloud migration

Do you have Microsoft 365 Business Premium, or an equivalent license that includes device management?
How many devices would be set up?
What operating systems are on those devices?
Do people use their own phones or computers for work?
Are servers still in the office?
How many applications would have to move?
How much data would move?
Do you know which licenses the move would need?
Is the office internet enough for daily work in the cloud?
Are the systems that would move backed up?
SOC 2 readiness

Readiness only. This is not a SOC 2 audit. Every question has to be answered or the module stays blank.

Do you require multifactor authentication for email and for admin sign-in?
When someone leaves, do you remove their access within a few business days?
Do you review who has admin access at least twice a year?
Are shared passwords forbidden for systems that hold customer data?
Do you limit production access to people who need it for their job?
Are production changes reviewed by someone other than the person who made them?
Can you tell what changed in production and who changed it?
Do you test changes before they reach customers?
When a port is opened to the internet, does someone review that choice?
Do you keep security and admin logs for at least 90 days?
Does someone look at alerts for failed admin sign-ins?
Is there a named person for security alerts?
Do you have a written incident plan?
Have you practiced or used that plan in the last year?
Do you record incidents and what you changed afterward?
Do you keep a list of vendors that store or see customer data?
Do you review a vendor's security before you sign, and again when you renew?
Are important systems backed up on a schedule?
Have you restored from a backup in the last year?
Do you know who is told if a customer-facing system is down?
Do you have written security policies that employees can read?
Do new hires acknowledge those policies?
Is there a named owner for security?
Do you patch operating systems and apps on a set schedule?
Are laptops that hold customer data encrypted?
Can you cut off a lost laptop?
Do you know where customer personal data is stored?

Downtime cost

Optional. The result is an estimate of cost per hour, not a guarantee.

SaaS sprawl

Optional expense CSV. It is read in memory and the raw file is not stored.

SSL re-check